80cff6c6a11d7ea476a8d0863a0e70e369ef6a841a0462f679d24b422d01715e

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
27-03-2024 10:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2024-03-27_856ca56e5fbc8d2bbab859f798420c20_goldeneye.exe
Size

216KB
MD5

856ca56e5fbc8d2bbab859f798420c20
SHA1

083e7a153bcbea1f3ecd0db8ebb6c87b6a3d2468
SHA256

80cff6c6a11d7ea476a8d0863a0e70e369ef6a841a0462f679d24b422d01715e
SHA512

5e6b9939641a4f2cb6a4aca2b5533e9a77e51095e6f21e0769d99c4015b8e94b2bb20d9fcceb79b28e8380d31f717a7c9334592c049c1ca1af6c1300265155f7
SSDEEP

3072:jEGh0oNl+Oso7ie+rcC4F0fJGRIS8Rfd7eQEcGcrcMUy:jEGblEeKcAEcGy

Score

9^/10

persistence

Malware Config

Signatures

Auto-generated rule 12 IoCs

resource	yara_rule
behavioral2/files/0x00070000000231f0-2.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x00110000000231f5-6.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x0007000000023205-8.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002330b-14.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002336a-19.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000900000002330b-22.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000002336a-26.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000600000001e565-30.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000700000002349d-34.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000800000001e565-38.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000e000000023101-42.dat	GoldenEyeRansomware_Dropper_MalformedZoomit
behavioral2/files/0x000d00000002311b-46.dat	GoldenEyeRansomware_Dropper_MalformedZoomit

Modifies Installed Components in the registry 2 TTPs 24 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1B50505-42B1-475a-8959-D60BF2474666}\stubpath = "C:\\Windows\\{A1B50505-42B1-475a-8959-D60BF2474666}.exe"	{A018223F-E441-421d-BDED-8CF3F7331B91}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{932BFDC7-0E39-4841-AE22-BAC7629A36C5}\stubpath = "C:\\Windows\\{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe"	{A1B50505-42B1-475a-8959-D60BF2474666}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D80BA58-F9EF-415e-929A-31FE5995D41A}	{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{914D492E-2295-4de8-904A-30CA0F260252}	{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{218DC577-C0DF-4a5f-B8CC-F64850FE4580}\stubpath = "C:\\Windows\\{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe"	{914D492E-2295-4de8-904A-30CA0F260252}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}	{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}\stubpath = "C:\\Windows\\{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe"	{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{948E660C-4908-4ed2-A38A-71C9014C9769}	{F0BD7FFA-5CC2-4591-9652-2630BD5A55B1}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A1B50505-42B1-475a-8959-D60BF2474666}	{A018223F-E441-421d-BDED-8CF3F7331B91}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{218DC577-C0DF-4a5f-B8CC-F64850FE4580}	{914D492E-2295-4de8-904A-30CA0F260252}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}\stubpath = "C:\\Windows\\{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe"	{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0BD7FFA-5CC2-4591-9652-2630BD5A55B1}	{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{948E660C-4908-4ed2-A38A-71C9014C9769}\stubpath = "C:\\Windows\\{948E660C-4908-4ed2-A38A-71C9014C9769}.exe"	{F0BD7FFA-5CC2-4591-9652-2630BD5A55B1}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A018223F-E441-421d-BDED-8CF3F7331B91}\stubpath = "C:\\Windows\\{A018223F-E441-421d-BDED-8CF3F7331B91}.exe"	2024-03-27_856ca56e5fbc8d2bbab859f798420c20_goldeneye.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{932BFDC7-0E39-4841-AE22-BAC7629A36C5}	{A1B50505-42B1-475a-8959-D60BF2474666}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2D80BA58-F9EF-415e-929A-31FE5995D41A}\stubpath = "C:\\Windows\\{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe"	{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}	{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}\stubpath = "C:\\Windows\\{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe"	{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}	{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F0BD7FFA-5CC2-4591-9652-2630BD5A55B1}\stubpath = "C:\\Windows\\{F0BD7FFA-5CC2-4591-9652-2630BD5A55B1}.exe"	{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A018223F-E441-421d-BDED-8CF3F7331B91}	2024-03-27_856ca56e5fbc8d2bbab859f798420c20_goldeneye.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}\stubpath = "C:\\Windows\\{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe"	{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{914D492E-2295-4de8-904A-30CA0F260252}\stubpath = "C:\\Windows\\{914D492E-2295-4de8-904A-30CA0F260252}.exe"	{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}	{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe

Deletes itself 1 IoCs

pid	Process
2668	cmd.exe

Executes dropped EXE 12 IoCs

pid	Process
4144	{A018223F-E441-421d-BDED-8CF3F7331B91}.exe
1992	{A1B50505-42B1-475a-8959-D60BF2474666}.exe
4396	{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe
3656	{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe
528	{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe
1468	{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe
2064	{914D492E-2295-4de8-904A-30CA0F260252}.exe
2428	{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe
2460	{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe
3256	{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe
2572	{F0BD7FFA-5CC2-4591-9652-2630BD5A55B1}.exe
5060	{948E660C-4908-4ed2-A38A-71C9014C9769}.exe

Drops file in Windows directory 12 IoCs

description	ioc	Process
File created	C:\Windows\{A018223F-E441-421d-BDED-8CF3F7331B91}.exe	2024-03-27_856ca56e5fbc8d2bbab859f798420c20_goldeneye.exe
File created	C:\Windows\{A1B50505-42B1-475a-8959-D60BF2474666}.exe	{A018223F-E441-421d-BDED-8CF3F7331B91}.exe
File created	C:\Windows\{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe	{A1B50505-42B1-475a-8959-D60BF2474666}.exe
File created	C:\Windows\{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe	{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe
File created	C:\Windows\{914D492E-2295-4de8-904A-30CA0F260252}.exe	{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe
File created	C:\Windows\{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe	{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe
File created	C:\Windows\{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe	{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe
File created	C:\Windows\{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe	{914D492E-2295-4de8-904A-30CA0F260252}.exe
File created	C:\Windows\{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe	{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe
File created	C:\Windows\{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe	{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe
File created	C:\Windows\{F0BD7FFA-5CC2-4591-9652-2630BD5A55B1}.exe	{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe
File created	C:\Windows\{948E660C-4908-4ed2-A38A-71C9014C9769}.exe	{F0BD7FFA-5CC2-4591-9652-2630BD5A55B1}.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	1608	2024-03-27_856ca56e5fbc8d2bbab859f798420c20_goldeneye.exe
Token: SeIncBasePriorityPrivilege	4144	{A018223F-E441-421d-BDED-8CF3F7331B91}.exe
Token: SeIncBasePriorityPrivilege	1992	{A1B50505-42B1-475a-8959-D60BF2474666}.exe
Token: SeIncBasePriorityPrivilege	4396	{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe
Token: SeIncBasePriorityPrivilege	3656	{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe
Token: SeIncBasePriorityPrivilege	528	{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe
Token: SeIncBasePriorityPrivilege	1468	{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe
Token: SeIncBasePriorityPrivilege	2064	{914D492E-2295-4de8-904A-30CA0F260252}.exe
Token: SeIncBasePriorityPrivilege	2428	{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe
Token: SeIncBasePriorityPrivilege	2460	{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe
Token: SeIncBasePriorityPrivilege	3256	{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe
Token: SeIncBasePriorityPrivilege	2572	{F0BD7FFA-5CC2-4591-9652-2630BD5A55B1}.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1608 wrote to memory of 4144	1608	2024-03-27_856ca56e5fbc8d2bbab859f798420c20_goldeneye.exe	98
PID 1608 wrote to memory of 4144	1608	2024-03-27_856ca56e5fbc8d2bbab859f798420c20_goldeneye.exe	98
PID 1608 wrote to memory of 4144	1608	2024-03-27_856ca56e5fbc8d2bbab859f798420c20_goldeneye.exe	98
PID 1608 wrote to memory of 2668	1608	2024-03-27_856ca56e5fbc8d2bbab859f798420c20_goldeneye.exe	99
PID 1608 wrote to memory of 2668	1608	2024-03-27_856ca56e5fbc8d2bbab859f798420c20_goldeneye.exe	99
PID 1608 wrote to memory of 2668	1608	2024-03-27_856ca56e5fbc8d2bbab859f798420c20_goldeneye.exe	99
PID 4144 wrote to memory of 1992	4144	{A018223F-E441-421d-BDED-8CF3F7331B91}.exe	100
PID 4144 wrote to memory of 1992	4144	{A018223F-E441-421d-BDED-8CF3F7331B91}.exe	100
PID 4144 wrote to memory of 1992	4144	{A018223F-E441-421d-BDED-8CF3F7331B91}.exe	100
PID 4144 wrote to memory of 1792	4144	{A018223F-E441-421d-BDED-8CF3F7331B91}.exe	101
PID 4144 wrote to memory of 1792	4144	{A018223F-E441-421d-BDED-8CF3F7331B91}.exe	101
PID 4144 wrote to memory of 1792	4144	{A018223F-E441-421d-BDED-8CF3F7331B91}.exe	101
PID 1992 wrote to memory of 4396	1992	{A1B50505-42B1-475a-8959-D60BF2474666}.exe	104
PID 1992 wrote to memory of 4396	1992	{A1B50505-42B1-475a-8959-D60BF2474666}.exe	104
PID 1992 wrote to memory of 4396	1992	{A1B50505-42B1-475a-8959-D60BF2474666}.exe	104
PID 1992 wrote to memory of 4552	1992	{A1B50505-42B1-475a-8959-D60BF2474666}.exe	105
PID 1992 wrote to memory of 4552	1992	{A1B50505-42B1-475a-8959-D60BF2474666}.exe	105
PID 1992 wrote to memory of 4552	1992	{A1B50505-42B1-475a-8959-D60BF2474666}.exe	105
PID 4396 wrote to memory of 3656	4396	{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe	107
PID 4396 wrote to memory of 3656	4396	{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe	107
PID 4396 wrote to memory of 3656	4396	{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe	107
PID 4396 wrote to memory of 4188	4396	{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe	108
PID 4396 wrote to memory of 4188	4396	{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe	108
PID 4396 wrote to memory of 4188	4396	{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe	108
PID 3656 wrote to memory of 528	3656	{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe	109
PID 3656 wrote to memory of 528	3656	{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe	109
PID 3656 wrote to memory of 528	3656	{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe	109
PID 3656 wrote to memory of 4940	3656	{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe	110
PID 3656 wrote to memory of 4940	3656	{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe	110
PID 3656 wrote to memory of 4940	3656	{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe	110
PID 528 wrote to memory of 1468	528	{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe	112
PID 528 wrote to memory of 1468	528	{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe	112
PID 528 wrote to memory of 1468	528	{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe	112
PID 528 wrote to memory of 4060	528	{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe	113
PID 528 wrote to memory of 4060	528	{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe	113
PID 528 wrote to memory of 4060	528	{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe	113
PID 1468 wrote to memory of 2064	1468	{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe	114
PID 1468 wrote to memory of 2064	1468	{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe	114
PID 1468 wrote to memory of 2064	1468	{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe	114
PID 1468 wrote to memory of 4456	1468	{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe	115
PID 1468 wrote to memory of 4456	1468	{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe	115
PID 1468 wrote to memory of 4456	1468	{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe	115
PID 2064 wrote to memory of 2428	2064	{914D492E-2295-4de8-904A-30CA0F260252}.exe	116
PID 2064 wrote to memory of 2428	2064	{914D492E-2295-4de8-904A-30CA0F260252}.exe	116
PID 2064 wrote to memory of 2428	2064	{914D492E-2295-4de8-904A-30CA0F260252}.exe	116
PID 2064 wrote to memory of 2996	2064	{914D492E-2295-4de8-904A-30CA0F260252}.exe	117
PID 2064 wrote to memory of 2996	2064	{914D492E-2295-4de8-904A-30CA0F260252}.exe	117
PID 2064 wrote to memory of 2996	2064	{914D492E-2295-4de8-904A-30CA0F260252}.exe	117
PID 2428 wrote to memory of 2460	2428	{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe	122
PID 2428 wrote to memory of 2460	2428	{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe	122
PID 2428 wrote to memory of 2460	2428	{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe	122
PID 2428 wrote to memory of 2264	2428	{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe	123
PID 2428 wrote to memory of 2264	2428	{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe	123
PID 2428 wrote to memory of 2264	2428	{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe	123
PID 2460 wrote to memory of 3256	2460	{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe	129
PID 2460 wrote to memory of 3256	2460	{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe	129
PID 2460 wrote to memory of 3256	2460	{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe	129
PID 2460 wrote to memory of 4544	2460	{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe	130
PID 2460 wrote to memory of 4544	2460	{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe	130
PID 2460 wrote to memory of 4544	2460	{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe	130
PID 3256 wrote to memory of 2572	3256	{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe	131
PID 3256 wrote to memory of 2572	3256	{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe	131
PID 3256 wrote to memory of 2572	3256	{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe	131
PID 3256 wrote to memory of 4508	3256	{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe	132

C:\Users\Admin\AppData\Local\Temp\2024-03-27_856ca56e5fbc8d2bbab859f798420c20_goldeneye.exe
"C:\Users\Admin\AppData\Local\Temp\2024-03-27_856ca56e5fbc8d2bbab859f798420c20_goldeneye.exe"
1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1608
- C:\Windows\{A018223F-E441-421d-BDED-8CF3F7331B91}.exe
  C:\Windows\{A018223F-E441-421d-BDED-8CF3F7331B91}.exe
  2⤵
  - Modifies Installed Components in the registry
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:4144
- - C:\Windows\{A1B50505-42B1-475a-8959-D60BF2474666}.exe
    C:\Windows\{A1B50505-42B1-475a-8959-D60BF2474666}.exe
    3⤵
    - Modifies Installed Components in the registry
    - Executes dropped EXE
    - Drops file in Windows directory
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1992
  - - C:\Windows\{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe
      C:\Windows\{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe
      4⤵
      Modifies Installed Components in the registry
      Executes dropped EXE
      Drops file in Windows directory
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4396
    - - C:\Windows\{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe
        
        C:\Windows\{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe
        5⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3656
      - C:\Windows\{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe
        
        C:\Windows\{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe
        6⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:528
        
        C:\Windows\{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe
        
        C:\Windows\{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe
        7⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\{914D492E-2295-4de8-904A-30CA0F260252}.exe
        
        C:\Windows\{914D492E-2295-4de8-904A-30CA0F260252}.exe
        8⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2064
        
        C:\Windows\{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe
        
        C:\Windows\{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe
        9⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2428
        
        C:\Windows\{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe
        
        C:\Windows\{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe
        10⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:2460
        
        C:\Windows\{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe
        
        C:\Windows\{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe
        11⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:3256
        
        C:\Windows\{F0BD7FFA-5CC2-4591-9652-2630BD5A55B1}.exe
        
        C:\Windows\{F0BD7FFA-5CC2-4591-9652-2630BD5A55B1}.exe
        12⤵
        Modifies Installed Components in the registry
        Executes dropped EXE
        Drops file in Windows directory
        Suspicious use of AdjustPrivilegeToken
        
        PID:2572
        
        C:\Windows\{948E660C-4908-4ed2-A38A-71C9014C9769}.exe
        
        C:\Windows\{948E660C-4908-4ed2-A38A-71C9014C9769}.exe
        13⤵
        Executes dropped EXE
        
        PID:5060
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{F0BD7~1.EXE > nul
        13⤵
        
        PID:2812
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{A8B2B~1.EXE > nul
        12⤵
        
        PID:4508
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{3C32E~1.EXE > nul
        11⤵
        
        PID:4544
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{218DC~1.EXE > nul
        10⤵
        
        PID:2264
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{914D4~1.EXE > nul
        9⤵
        
        PID:2996
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{76F8F~1.EXE > nul
        8⤵
        
        PID:4456
        
        C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{CC20B~1.EXE > nul
        7⤵
        
        PID:4060
      - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{2D80B~1.EXE > nul
        6⤵
        
        PID:4940
    - - C:\Windows\SysWOW64\cmd.exe
        
        C:\Windows\system32\cmd.exe /c del C:\Windows\{932BF~1.EXE > nul
        5⤵
        
        PID:4188
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Windows\{A1B50~1.EXE > nul
      4⤵
      PID:4552
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del C:\Windows\{A0182~1.EXE > nul
    3⤵
    PID:1792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\2024-0~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\{218DC577-C0DF-4a5f-B8CC-F64850FE4580}.exe

Filesize
216KB

MD5
7b0bc7b2f7ce5db48f9618e715964d56

SHA1
0df64584b5b46e1d243b0bf88e68b3963e24ab06

SHA256
ea26322b5b061808cdd632a4ec5b2b28a6d24a61447dff5aec2eb57f5cf2d485

SHA512
db818110625b5f0870c4173d7137fbdd7fbcb2039ea06f434b260e23ef0b78f3fa78dc41d454fb5c2e62b0d73aaa5d1086118d6456691fa75f62243e100bb2ce

Download Submit
C:\Windows\{2D80BA58-F9EF-415e-929A-31FE5995D41A}.exe

Filesize
216KB

MD5
8039acb75e5432ccee42b29b4b670dd3

SHA1
dd0370dcbb76f60db16fc1cfc897cb0b2e1e47f0

SHA256
a6f2525827eff5e47907f6f96f365007e1682104f266c69aac4c37db25caeeec

SHA512
807dd8cf65f63b468c49f00b3482f11ca3008378c315844797ddc74b32cd54f86f0496398f3e3cfdaba43ecd89725ee917f74772d79582be9843f2d583dda894

Download Submit
C:\Windows\{3C32ED75-7EBE-4fd3-BCC8-05323E2CA143}.exe

Filesize
216KB

MD5
a4d85b2e64c97c751e4ad4d5cc893812

SHA1
b293518e5565f1ecf4a099de169ae64d9260b995

SHA256
86ac553860d1ec78f535236df8d486da73915c8fb3dde36b682b8cbc3911d2b6

SHA512
470e0dae61790a576c3b7606f51b92709a3e46a319326c004697e809cc7ccc08bd78f3ff23c965533585168f9a5b1f743f51e75080a70203e8c4ee2f46d730c0

Download Submit
C:\Windows\{76F8F07A-9248-4a80-8C68-BAB4BEDF9F98}.exe

Filesize
216KB

MD5
a339b803ecf0d692f1020b08464520f6

SHA1
cfaba7554cc8d65b86cea4d1070700dcf44bdc25

SHA256
830937751562eebae1e277db9683ac4987a0363d3ef7acc5ebc37fa1d43bd29d

SHA512
91ee3adfad2943bee48db6dfe3c1daa5a8fce0c6a70d59b1419d1d6f41eece78b0f7f33511bbd041d8f94e3126e9f0a8b0b41623b0778cce959555de4d968f49

Download Submit
C:\Windows\{914D492E-2295-4de8-904A-30CA0F260252}.exe

Filesize
216KB

MD5
505bcb05df0341fa357a64142a73871f

SHA1
8a81181c841c824c5bd9da0bed7cf838e03d16e7

SHA256
a412650d9b9f7424d036242f9f852a4828d0316b09145157bba4488ff537ecdd

SHA512
93581b053d548f9852c806f9d874877e3f908b7dd6d6f9bfd8a546910f7e814e799df2a73a1a1278445c9202f2bb7c68837bb995314304491db15e5262d14328

Download Submit
C:\Windows\{932BFDC7-0E39-4841-AE22-BAC7629A36C5}.exe

Filesize
216KB

MD5
ca4f3f24aa0cecce300560eacd868661

SHA1
21ad0ad27db7aa4ae5b0746c16d1102fd84f0af3

SHA256
95c6443e277b2a05f4471d51a670b33a69d7a068639060463f10e3a277c78283

SHA512
2068bb2e2ef4f03caa5d5bec9fe20e512e0e2af0f17dcb7798118236dc54c615af838783ec19b6e0529be47f32e1b6309d1cb8bc28887a8de21aebff85ff5baa

Download Submit
C:\Windows\{948E660C-4908-4ed2-A38A-71C9014C9769}.exe

Filesize
216KB

MD5
a21703540b26db63414d1331be652267

SHA1
d39e157b2f1020a12c7e130ac3dcdbc1a294b031

SHA256
d1aa0ec34543931916f4c3216c62e52e39ecba78e7fe3cfd2152760c063d11b9

SHA512
33d26a434c11d0552a239f4a85da557516517460bd59a6dac45016ed007c50bc1ee0157c308e389393d39bace21919a69c6f09bb49271068e3c5d6b714daf6a3

Download Submit
C:\Windows\{A018223F-E441-421d-BDED-8CF3F7331B91}.exe

Filesize
216KB

MD5
17aa1fb1471e0abf328f23a577c9c863

SHA1
3724df8f9090bc402b2fb93b2ec990f6bdce17a4

SHA256
67c7ce69a597348b2711bb374e6cf071fcf3ef8b9136b10bfb67fed9ada498b7

SHA512
41a23e22965d92a1aa3f834e68d147f4582d094404e226f4cc6ad050da746878d767fa7ebf4bc21ce5e4793afdca89516faf151a287af036202a77bcdbaa7210

Download Submit
C:\Windows\{A1B50505-42B1-475a-8959-D60BF2474666}.exe

Filesize
216KB

MD5
8bdcd5d2886f02e2305e0a76cffe67a5

SHA1
cb14f736efbfb14336534ecebd0bdea2acf780e6

SHA256
623c75579e1106dd8ee4972335c272ea58f096c3623467248c90383f83df14e8

SHA512
b3dfe66c4388881205423db6e110a087a22bac9604efba632daf1c003add6e55360040a8e9374badbe6a27181b1ca3d3efd8105af754dd666a4549e1dd6975f2

Download Submit
C:\Windows\{A8B2B477-BAD5-4227-A05B-32D84D8EA63C}.exe

Filesize
216KB

MD5
64eb17ac8b10f4f24470aeadc3d71d90

SHA1
4cfb7f738560ffbe0d6a41bc628afc6814d36132

SHA256
4814f64c07590e990649b875f7d61184dfd268833ad85b9858c41dbd01aa2806

SHA512
df7b3bc6a2b823601cdff4a11deab105d40007275c8be2bfe9513e622d0aa7c269721faf39ca83f0921b9ef9647884e7da0956e3eb78b0ec89c0f1dad4ddb45a

Download Submit
C:\Windows\{CC20BEA3-71E0-4e47-A62B-69D420E9AAD5}.exe

Filesize
216KB

MD5
6113ca66156befaca53d0392c4659130

SHA1
5c5d4724c0b4b3e7880ddd6c30d621a8fc3fc214

SHA256
e912222d9100d457e45e9c6ba1139cc2acfa1bb2bc555ff00a89028241f4dcf2

SHA512
3aaf988ee3d64f31d06d30c7a87c18ef1af2a8e7d93f0eb32fd5be4bdd5050a5339959e54a6776696264a0ecb51aa0361a4905f29365acca89922053062680b7

Download Submit
C:\Windows\{F0BD7FFA-5CC2-4591-9652-2630BD5A55B1}.exe

Filesize
216KB

MD5
95c673f66ca6c8e9795f5f2d3d9e58da

SHA1
bbd3ae756a65223a85ea4e5d0e66ebb8ab54e339

SHA256
0fb51e584d2f64055415e6d2af36382cd19105163afdd4a8b4056c3ca7641170

SHA512
0dd772f7d006c30d1fb2db68e3e64225e28356e899c35c72b965216de2e2b2d48a3ff8d329d003e1dbd9cc339e7f70cb4590a9d403c01611d0ae2538bc238296

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads